[syzbot] [rdma?] WARNING in rxe_pool_cleanup

Hello,

syzbot found the following issue on:

HEAD commit: 6d7ddd805123 Merge tag 'soc-fixes-6.9-3' of git://git.kern..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1567aa6c980000
kernel config: https://syzkaller.appspot.com/x/.config?x=7144b4fe7fbf5900
dashboard link: https://syzkaller.appspot.com/bug?extid=221e213bf17f17e0d6cd
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/7bc7510fe41f/non_bootable_disk-6d7ddd80.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/64e247bdde82/vmlinux-6d7ddd80.xz
kernel image: https://storage.googleapis.com/syzbot-assets/b78396634af8/bzImage-6d7ddd80.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: [email protected]

------------[ cut here ]------------
WARNING: CPU: 2 PID: 11465 at drivers/infiniband/sw/rxe/rxe_pool.c:116 rxe_pool_cleanup+0x41/0x60 drivers/infiniband/sw/rxe/rxe_pool.c:116
Modules linked in:
CPU: 2 PID: 11465 Comm: syz-executor.2 Not tainted 6.9.0-rc7-syzkaller-00023-g6d7ddd805123 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
RIP: 0010:rxe_pool_cleanup+0x41/0x60 drivers/infiniband/sw/rxe/rxe_pool.c:116
Code: 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 1f 48 83 bb 80 00 00 00 00 75 06 5b e9 95 28 73 f9 e8 90 28 73 f9 90 <0f> 0b 90 5b e9 86 28 73 f9 e8 81 75 ce f9 eb da 66 66 2e 0f 1f 84
RSP: 0018:ffffc90003baf170 EFLAGS: 00010246
RAX: 0000000000040000 RBX: ffff8880471b5228 RCX: ffffc90003f99000
RDX: 0000000000040000 RSI: ffffffff881aa460 RDI: ffff8880471b52a8
RBP: ffffffff88190dd0 R08: 0000000000000005 R09: 0000000000000000
R10: 00000000ffffffed R11: 0000000000000000 R12: ffffc90003baf600
R13: ffffc90003baf600 R14: ffff88804570c000 R15: 0000000000000000
FS: 00007fedd04706c0(0000) GS:ffff88806b400000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1c5125dd58 CR3: 000000003df64000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
rxe_dealloc+0x26/0x110 drivers/infiniband/sw/rxe/rxe.c:24
ib_dealloc_device+0x46/0x230 drivers/infiniband/core/device.c:657
rxe_net_add+0xb2/0xe0 drivers/infiniband/sw/rxe/rxe_net.c:536
rxe_newlink+0x70/0x190 drivers/infiniband/sw/rxe/rxe.c:197
nldev_newlink+0x396/0x670 drivers/infiniband/core/nldev.c:1763
rdma_nl_rcv_msg+0x388/0x6e0 drivers/infiniband/core/netlink.c:195
rdma_nl_rcv_skb.constprop.0.isra.0+0x2e6/0x450 drivers/infiniband/core/netlink.c:239
netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline]
netlink_unicast+0x542/0x820 net/netlink/af_netlink.c:1361
netlink_sendmsg+0x8b8/0xd70 net/netlink/af_netlink.c:1905
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg net/socket.c:745 [inline]
____sys_sendmsg+0xab5/0xc90 net/socket.c:2584
___sys_sendmsg+0x135/0x1e0 net/socket.c:2638
__sys_sendmsg+0x117/0x1f0 net/socket.c:2667
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcf/0x260 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fedcf67dd69
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fedd04700c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007fedcf7abf80 RCX: 00007fedcf67dd69
RDX: 0000000000000000 RSI: 00000000200001c0 RDI: 0000000000000004
RBP: 00007fedcf6ca49e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000000b R14: 00007fedcf7abf80 R15: 00007ffcb1bc3058
</TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at [email protected].

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Hi,

I made a lot of tests and this problem can not be reproduced in the
local host.

Can you share your script file that caused this problem with us?
So we can delve into this script file and reproduce this problem in the
local host.

Thanks a lot.
Zhu Yanjun

syzbot has found a reproducer for the following issue on:

HEAD commit: bb066fe812d6 Merge tag 'pci-v6.14-fixes-2' of git://git.ke..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16a973df980000
kernel config: https://syzkaller.appspot.com/x/.config?x=1909f2f0d8e641ce
dashboard link: https://syzkaller.appspot.com/bug?extid=221e213bf17f17e0d6cd
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11a01df8580000

Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/7feb34a89c2a/non_bootable_disk-bb066fe8.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/ac7155966351/vmlinux-bb066fe8.xz
kernel image: https://storage.googleapis.com/syzbot-assets/92d6cbf35949/bzImage-bb066fe8.xz
smc: removing ib device syz0
------------[ cut here ]------------
WARNING: CPU: 0 PID: 5645 at drivers/infiniband/sw/rxe/rxe_pool.c:116 rxe_pool_cleanup+0x47/0x50 drivers/infiniband/sw/rxe/rxe_pool.c:116
Modules linked in:
CPU: 0 UID: 0 PID: 5645 Comm: syz.0.16 Not tainted 6.14.0-rc1-syzkaller-00081-gbb066fe812d6 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:rxe_pool_cleanup+0x47/0x50 drivers/infiniband/sw/rxe/rxe_pool.c:116
Code: 00 00 fc ff df 80 3c 08 00 74 08 48 89 df e8 10 aa 1a f9 48 83 3b 00 75 0b e8 95 11 b4 f8 5b c3 cc cc cc cc e8 8a 11 b4 f8 90 <0f> 0b 90 5b c3 cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc9000ce370e8 EFLAGS: 00010293
RAX: ffffffff890b4c96 RBX: ffff888052855380 RCX: ffff88801f3e8000
RDX: 0000000000000000 RSI: 0000000000000002 RDI: ffff888052855300
RBP: 0000000000000002 R08: ffffffff88e3bcc3 R09: 1ffff1100a50a8ee
R10: dffffc0000000000 R11: ffffffff89096000 R12: dffffc0000000000
R13: dffffc0000000000 R14: ffff888052854658 R15: dffffc0000000000
FS: 00007fc32943e6c0(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CR2: 00007fc32943dfe0 CR3: 00000000405a6000 CR4: 0000000000352ef0
rxe_dealloc+0x33/0x100 drivers/infiniband/sw/rxe/rxe.c:24
ib_dealloc_device+0x50/0x200 drivers/infiniband/core/device.c:647
__ib_unregister_device+0x366/0x3d0 drivers/infiniband/core/device.c:1520
ib_unregister_device_and_put+0xb9/0xf0 drivers/infiniband/core/device.c:1567
nldev_dellink+0x2c6/0x310 drivers/infiniband/core/nldev.c:1825
rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline]
rdma_nl_rcv+0x6dd/0x9e0 drivers/infiniband/core/netlink.c:259
netlink_unicast_kernel net/netlink/af_netlink.c:1322 [inline]
netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1348
netlink_sendmsg+0x8e4/0xcb0 net/netlink/af_netlink.c:1892
sock_sendmsg_nosec net/socket.c:713 [inline]
__sock_sendmsg+0x221/0x270 net/socket.c:728
____sys_sendmsg+0x52a/0x7e0 net/socket.c:2568
___sys_sendmsg net/socket.c:2622 [inline]
__sys_sendmsg+0x269/0x350 net/socket.c:2654
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc32858cde9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc32943e038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007fc3287a6160 RCX: 00007fc32858cde9
RDX: 0000000020000000 RSI: 0000200000000000 RDI: 0000000000000004
RBP: 00007fc32860e2a0 R08: 0000000000000000 R09: 0000000000000000
R13: 0000000000000000 R14: 00007fc3287a6160 R15: 00007ffc02559df8
</TASK>


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

syzbot has found a reproducer for the following issue on:

HEAD commit: 21e4543a2e2f Merge tag 'slab-for-6.14-rc5' of git://git.ke..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=15db14b7980000
kernel config: https://syzkaller.appspot.com/x/.config?x=2040405600e83619
dashboard link: https://syzkaller.appspot.com/bug?extid=221e213bf17f17e0d6cd
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14819878580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13db14b7980000

Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/7feb34a89c2a/non_bootable_disk-21e4543a.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/65830427be5d/vmlinux-21e4543a.xz
kernel image: https://storage.googleapis.com/syzbot-assets/d0e255ba87f2/bzImage-21e4543a.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/cd82bec15deb/mount_0.gz
fsck result: failed (log: https://syzkaller.appspot.com/x/fsck.log?x=12dfaa64580000)
------------[ cut here ]------------
WARNING: CPU: 0 PID: 5401 at drivers/infiniband/sw/rxe/rxe_pool.c:116 rxe_pool_cleanup+0x47/0x50 drivers/infiniband/sw/rxe/rxe_pool.c:116
Modules linked in:
CPU: 0 UID: 0 PID: 5401 Comm: syz-executor270 Not tainted 6.14.0-rc5-syzkaller-00214-g21e4543a2e2f #0
Code: 00 00 fc ff df 80 3c 08 00 74 08 48 89 df e8 c0 6b 11 f9 48 83 3b 00 75 0b e8 b5 2f aa f8 5b c3 cc cc cc cc e8 aa 2f aa f8 90 <0f> 0b 90 5b c3 cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc9000d63f0e8 EFLAGS: 00010293
RAX: ffffffff8917af46 RBX: ffff88804bc69380 RCX: ffff8880002f8000
RDX: 0000000000000000 RSI: 0000000000000002 RDI: ffff88804bc69300
RBP: 0000000000000002 R08: ffffffff88f02df3 R09: 1ffff1100978d0ee
R10: dffffc0000000000 R11: ffffffff8915c190 R12: dffffc0000000000
R13: dffffc0000000000 R14: ffff88804bc68658 R15: dffffc0000000000
FS: 00007fdbc26506c0(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CR2: 0000000000000000 CR3: 000000004bbba000 CR4: 0000000000352ef0
netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline]
netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1338
netlink_sendmsg+0x8de/0xcb0 net/netlink/af_netlink.c:1882
sock_sendmsg_nosec net/socket.c:718 [inline]
__sock_sendmsg+0x221/0x270 net/socket.c:733
____sys_sendmsg+0x53a/0x860 net/socket.c:2573
___sys_sendmsg net/socket.c:2627 [inline]
__sys_sendmsg+0x269/0x350 net/socket.c:2659
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fdbc26a2489
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fdbc2650168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007fdbc272f4c8 RCX: 00007fdbc26a2489
RDX: 0000000020000000 RSI: 00004000000002c0 RDI: 0000000000000005
RBP: 00007fdbc272f4c0 R08: 00007fdbc26506c0 R09: 0000000000000000
R10: 00007fdbc26506c0 R11: 0000000000000246 R12: 00007fdbc272f4cc
R13: 0000000000000006 R14: 00007ffd776089d0 R15: 00007ffd77608ab8

Hi, all

I delved into this problem. I found the following in the link
https://syzkaller.appspot.com/x/log.txt?x=16a973df980000

"
[ 73.687051][ T5401] infiniband syz0: set active
[ 73.688993][ T5401] infiniband syz0: added bond0
[ 73.724619][ T5401] RDS/IB: syz0: added
< --- It seems that RDS also used this rxe device in this test.
[ 73.726492][ T5401] smc: adding ib device syz0 with port count 1
[ 73.729145][ T5401] smc: ib device syz0 port 1 has pnetid
"

But when smc releases rxe device, RDS does not release rxe device.

The logs are as below
"
[ 76.652232][ T5401] smc: removing ib device syz0
[ 76.952936][ T5401] ------------[ cut here ]------------
[ 76.955199][ T5401] WARNING: CPU: 0 PID: 5401 at
drivers/infiniband/sw/rxe/rxe_pool.c:116 rxe_pool_cleanup+0x47/0x50
"
I have no idea about the whole test script. So I just suggest whether
this test script remove this RDS initialization because RDS does not do
any work in this script.

Or before smc removes ib device syz0, let RDS also release rxe device.

Then let us know whether this problem still occur or not.